The problem lies in accepting "m['xz'.substr(0, 1)] = true;". This line must only be accepted if a proof that 'xz'.substr(0, 1) != "x" is provided (for instanc

The problem lies in accepting "m['xz'.substr(0, 1)] = true;". This line must only be accepted if a proof that 'xz'.substr(0, 1) != "x" is provided (for instance, inferred from a runtime check or encoded as a type) [obviously, that's impossible with that specific value] While "unergonomic", code that doesn't do that is just broken and might for instance result in a security catastrophe if the key is attacker controlled.